CVE-2021-23567 | Hacker News Reader

CVE-2021-23567

nvd.nist.gov

4 pointssoheilpro4 comments

So let me get this straight - open source maintainer gets mad when large companies "abuse" open source, despite him making it MIT licensed and choosing himself to allow large companies to use it? And he believes the best response is to break the entire library?

Absolutely nobody forced this guy to use MIT - so why be mad when the license is used as written?

The MIT license says:

  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT

People are getting mad that this guy removed functionality from his open source project -- as if the open source license warranted fitness for a particular purpose.

I know what it says. Businesses, organizations, and basically everyone uses open source software because we all have a sort of agreement that says "Hey, the guy who maintains this software isn't going to purposefully fuck over everyone who is using it in a temper tantrum". Yes, what he did was legal. Conflating legality with morality is horrible, because this type of stuff is in no way, shape, or form moral. Doing things like this is also how you get absolutely nobody to use anything open source ever. It's horrible not just for his corner of the web that he wanted to have control over for some reason, but it affects the standing of ALL open source projects.

Besides, what if instead of just breaking it, he installed a cryptominer? Or a backdoor? You can't just say "lulz it says no warranty, you have to hold that" and expect literally anybody to think that is a reasonable response. This is how you get large organizations to decide that maybe open source isn't worth the risk.

The commit that caused this: https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d1...

Reply on news.ycombinator.com